auditd syslog builtin plugin
Hi,
I am trying to make the builtin syslog audisp plugin to use a custom
facility/priority pair for the syslog messages exported to the syslog
daemon. For that I am using the patch and the conf from below.
The problem is that the compile and the start process don't give any
errors when I am using the below customization but the syslog daemon
receive the messages from the audisp with the default facility
(LOG_USER). So I need a littel help here.
I would appreciate any help.
Thanks,
--
Cosmih
============================================================
/etc/audisp/plugins.d/syslog.conf
active = yes
direction = out
path = builtin_syslog
type = builtin
args = LOG_ALERT LOG_KERN
format = string
============================================================
============================================================
diff -ur audit-2.0.4/audisp/audispd-builtins.c
audit-2.0.4-new/audisp/audispd-builtins.c
--- audit-2.0.4/audisp/audispd-builtins.c 2009-12-07 23:16:41.000000000 +0200
+++ audit-2.0.4-new/audisp/audispd-builtins.c 2010-05-25
16:56:18.000000000 +0300
@@ -37,7 +37,7 @@
// Local data
static volatile int sock = -1, conn = -1;
-static int syslog_started = 0, priority;
+static int syslog_started = 0, priority, facility;
static char *path = NULL;
// Local prototypes
@@ -278,8 +278,25 @@
syslog_started = 0;
return;
}
- } else
+ } else {
priority = LOG_INFO;
+ }
+ if (conf->args[2]) {
+ if (strcasecmp(conf->args[2], "LOG_USER") == 0)
+ facility = LOG_USER
+ else if (strcasecmp(conf->args[2], "LOG_DAEMON") == 0)
+ facility = LOG_DAEMON;
+ else if (strcasecmp(conf->args[2], "LOG_KERN") == 0)
+ facility = LOG_KERN;
+ else {
+ syslog(LOG_ERR, "Unknown log priority %s",
+ conf->args[2]);
+ syslog_started = 0;
+ return;
+ }
+ else {
+ facility = LOG_KERN;
+ }
syslog_started = 1;
syslog(LOG_INFO, "syslog plugin initialized");
}
@@ -287,7 +304,7 @@
void send_syslog(const char *s)
{
if (syslog_started)
- syslog(priority, "%s", s);
+ syslog(facility|priority, "%s", s);
}
void destroy_syslog(void)
============================================================